The linker scripts assigned .tdata to a PT_LOAD segment and only .tbss to PT_TLS. GNU ld includes every SHF_TLS section in PT_TLS regardless of the explicit assignment, so the segment spanned .tdata..tbss as tls.c expects and this went unnoticed. LLD honours the assignment as written, leaving PT_TLS starting at .tbss -- a page above .tdata, since .tdata is padded to MAXPAGESIZE. Initialised __thread variables then get a TP offset of -(MAXPAGESIZE - 16). That is representable on x86_64, where variant II TLS puts variables below the thread pointer anyway, but not on aarch64, where linking test_tls fails with: relocation R_AARCH64_TLSLE_ADD_TPREL_HI12 out of range: ... references '_data_not_bss' Naming :tbss on .tdata as well reproduces what GNU ld already emitted, so this is a no-op there, and gives LLD the same layout: PT_TLS covering .tdata (padded) followed by .tbss, matching _ltdata/_ltbss and the block that solo5_tls_init() copies.